Node revoke leaves pending enrollment tokens valid

[Andreas-Froyland]

Problem

NodeService::revoke (crates/fleet-application/src/node.rs) revokes the node identity and its credentials but leaves the machine's pending enrollment tokens usable. enroll refuses only when the machine already has an active identity. Once revoked, a token issued before the revoke can enroll a new key as that machine until the token expires (up to one day).

An operator who revokes a node to cut off a compromised host expects no existing secret to bring it back.

Found in review of #157 (FM-911 machine page). The page now warns when pending tokens exist, but the fix belongs in the application layer.

Acceptance criteria

• Revoking a node also expires (or consumes) every pending enrollment token for that machine, in the same transaction as the identity revoke.
• The audit event for node_identity_revoked records how many tokens were invalidated (count only; never token material).
• A test covers: issue token → revoke → enroll with that token fails as unauthorized.

Non-goals

• UI changes. Once this lands, FM-911's pending-token warning can be dropped.

[Andreas-Froyland]

Implementation approach: extend the node revoke port so one SQLite transaction revokes the identity, credentials, and sessions, invalidates every still-pending enrollment token, and appends node_identity_revoked with only the invalidated-token count. I’ll cover token reuse after revoke plus the persisted audit count in application and SQLite tests. No UI changes.